CVE-2020-8286

Exploit

EPSS 0.28%
Published 14.12.2020 20:15:14
Last modified 21.11.2024 05:38:39
Source support@hackerone.com
Teams watchlist Login
Open Login

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

Affected products Warnungen 0 Metrics 3 CWE 1 References 22

Data is provided by the National Vulnerability Database (NVD)

Haxx ≫ Libcurl Version >= 7.41.0 < 7.74.0

Fedoraproject ≫ Fedora Version32

Fedoraproject ≫ Fedora Version33

Debian ≫ Debian Linux Version9.0

Debian ≫ Debian Linux Version10.0

Netapp ≫ Clustered Data Ontap Version-

Netapp ≫ Hci Management Node Version-

Netapp ≫ Solidfire Version-

Netapp ≫ Hci Bootstrap Os Version-

Netapp ≫ Hci Compute Node Version-

Netapp ≫ Hci Storage Node Firmware Version-

Netapp ≫ Hci Storage Node Version-

Apple ≫ macOS X Version < 10.14.6

Apple ≫ macOS X Version >= 10.15 < 10.15.7

Apple ≫ macOS X Version10.14.6 Update-

Apple ≫ macOS X Version10.14.6 Updatesecurity_update_2019-001

Apple ≫ macOS X Version10.14.6 Updatesecurity_update_2019-002

Apple ≫ macOS X Version10.14.6 Updatesecurity_update_2020-001

Apple ≫ macOS X Version10.14.6 Updatesecurity_update_2020-002

Apple ≫ macOS X Version10.14.6 Updatesecurity_update_2020-003

Apple ≫ macOS X Version10.14.6 Updatesecurity_update_2020-004

Apple ≫ macOS X Version10.14.6 Updatesecurity_update_2020-005

Apple ≫ macOS X Version10.14.6 Updatesecurity_update_2020-006

Apple ≫ macOS X Version10.14.6 Updatesecurity_update_2020-007

Apple ≫ macOS X Version10.14.6 Updatesecurity_update_2021-001

Apple ≫ macOS X Version10.15.7 Update-

Apple ≫ macOS X Version10.15.7 Updatesecurity_update_2020-001

Apple ≫ macOS X Version10.15.7 Updatesecurity_update_2021-001

Apple ≫ macOS X Version10.15.7 Updatesupplemental_update

Apple ≫ macOS Version >= 11.0 < 11.3

Siemens ≫ Simatic Tim 1531 Irc Firmware Version <= 2.2

Siemens ≫ Simatic Tim 1531 Irc Version-

Siemens ≫ Sinec Infrastructure Network Services Version < 1.0.1.1

Oracle ≫ Communications Billing And Revenue Management Version12.0.0.3.0

Oracle ≫ Communications Cloud Native Core Policy Version1.14.0

Oracle ≫ Essbase Version21.2

Oracle ≫ Peoplesoft Enterprise Peopletools Version8.58

Splunk ≫ Universal Forwarder Version >= 8.2.0 < 8.2.12

Splunk ≫ Universal Forwarder Version >= 9.0.0 < 9.0.6

Splunk ≫ Universal Forwarder Version9.1.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.28%	0.514

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://www.oracle.com/security-alerts/cpuapr2022.html

Patch

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Third Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

Patch

Third Party Advisory

http://seclists.org/fulldisclosure/2021/Apr/51

Third Party Advisory

Mailing List

https://support.apple.com/kb/HT212326

Third Party Advisory

https://support.apple.com/kb/HT212327

Third Party Advisory

https://support.apple.com/kb/HT212325

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf

Third Party Advisory

https://www.debian.org/security/2021/dsa-4881

Third Party Advisory

https://security.gentoo.org/glsa/202012-14

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html

Third Party Advisory

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/

Third Party Advisory

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/

Third Party Advisory

Mailing List

https://security.netapp.com/advisory/ntap-20210122-0007/

Third Party Advisory

http://seclists.org/fulldisclosure/2021/Apr/50

Third Party Advisory

Mailing List

http://seclists.org/fulldisclosure/2021/Apr/54

Third Party Advisory

Mailing List

https://curl.se/docs/CVE-2020-8286.html

Vendor Advisory

https://hackerone.com/reports/1048457

Patch

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2020-8286

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-8286

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-8286

EUVD